PT-2026-24254 · Oneuptime · Oneuptime

Iconnnjka · Publicado 2026-03-10 · Atualizado 2026-03-17 · CVE-2026-30958

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.21

Description OneUptime is a solution for monitoring and managing online services. A path traversal issue exists in the /workflow/docs/:componentName API endpoint, allowing unauthenticated reading of arbitrary files from the server filesystem. The componentName route parameter is directly concatenated into a file path and passed to the res.sendFile() function within the orker/FeatureSet/Workflow/Index.ts file without any sanitization or authentication checks.

Recommendations Update to version 10.0.21 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-30958

GHSA-P2WH-9PW8-HVFF

Produtos afetados

Oneuptime

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30958.json · Exploit
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p2wh-9pw8-hvff · Aviso do Fabricante
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.21 · Nota
• https://t.me/cveNotify/155276 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2033995745100021828 · Publicação no Twitter
• https://twitter.com/dailycve/status/2032168482570174823 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30958 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033994303748644965 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30958 · Nota de Segurança